Towards a Cyber Defense Framework for SCADA Systems Based on Power Consumption Monitoring

Abstract

Supervisory control and data acquisition (SCADA) systems are industrial automation systems that remotely monitor and control critical infrastructures. SCADA systems are major targets for espionage and sabotage attackers. We describe recent SCADA attacks that have caused serious financial losses and physical infrastructure damages Current commercial off-the-shelf security solutions are insufficient in protecting SCADA systems against sophisticated cyber-attacks. SCADA systems are often not monitored to the same level as business computer systems. Furthermore, these breaches are not detected in real-time or fast enough to prevent further damages. To address this challenge we did a feasibility study to prove that monitoring power consumption of SCADA devices is an effective approach to detect cyber-attacks. We built a testbed containing a Programmable Logic Controller (PLC) that was instrumented to record its power usage.Three SCADA-specific cyber-attacks were simulated and we report the power consumption of the PLC under these normal and anomalous scenarios. We show that it is possible to distinguish the PLC power utilization between these scenarios.